My website was hacked. What do I do now?
You are not imagining it and you did not do anything wrong. Somebody found a hole in the software your website runs on and let themselves in. Here is how to tell for sure, what happens if you wait, and what it costs to have a senior engineer clean it today for a flat $249.
Clean or your money back. Written. Flat $249, no hourly meter.
You do not need to know what your website is built with. We will tell you in the first 10 minutes.
Last updated · Reviewed by Ali Yasin Jatoi
Is this you?
- Your homepage shows text, adverts or a language you never put there
- Searching for your business name in Google shows page titles you do not recognise
- Visitors get sent to a pharmacy, casino, dating or download page
- There is an admin user in your website that nobody on your team created
- New pages appear in Google with names like cheap-shoes or online-pills
- Your emails to customers started landing in spam for no obvious reason
- The website is suddenly very slow, or your hosting bill jumped
- Your host sent a scan report listing files you have never heard of
- Card payments started failing, or customers report fraud after buying
- You cannot log in, and the password reset email never arrives
- Files in your website have a date and time you were asleep
- A customer told you before you noticed anything at all
If you ticked even one of these, send us the address of your website and we will look at it for free within the hour.
What being hacked actually means for a small business
It almost never means a person targeted you. It means an automated program tried millions of websites, found that yours was running old software, and slipped a few extra files in. Those files then do one of four jobs: send spam, show hidden pages to Google to sell pills or fake shoes, redirect your visitors to somebody who pays per click, or read the card details your customers type in. Your website keeps working, which is exactly the point. If it broke, you would fix it.
Why the visible damage is never the whole job
Whatever you can see is the symptom. Behind it there are usually two or three quiet ways back in: an extra admin account with an innocent name, a file that hides itself from the plugin list, a scheduled task that reinstalls everything at three in the morning. This is why so many owners clean a site on Monday and watch it break again on Thursday. A real cleanup closes the way in, not just the mess.
What happens if you leave it another week
Google will start showing a warning screen to your visitors, and once that happens the phone stops entirely. Your host will move from a warning to switching the account off. Your email starts getting blocked because your domain is on a spam list, which means your invoices stop arriving. And the attacker keeps digging, which turns a four hour job into a two day job. Every one of those costs more than $249.
What we hand you at the end
A written report listing every infected file we found, where it was, and what it did. Confirmation that every hidden account and scheduled task is gone. A request to Google to lift any warning. A clean scan you can forward to your host to get switched back on. And an honest sentence about how they got in, which is usually the part nobody else tells you.
What happens once you say go
- First 15 minutes
Free look
Send us the address. We check it from the outside and tell you what we can already see, at no cost and with no card.
- Hour 1
Copy then contain
We take a full copy of the whole website first, then remove the visible damage so your customers and Google stop seeing it.
- About 4 hours
Clean and locked
Infected files removed, hidden admin accounts deleted, scheduled tasks cleared, every password rotated, updates applied.
- Day 1 to 30
Warnings cleared
We submit the site to Google for review, hand your host their evidence, and watch the site for 30 days in case anything tries to come back.
What it costs
No quotes, no discovery calls, no hourly meter. You know the number before we touch anything.
- Emergency cleanup$249 flat
One website, one price. Median clean time about 4 hours from the moment we have access. Written report at the end.
- Cleanup plus hardening$449 flat
Everything above, plus locked down logins, file monitoring, and 60 days of reinfection cover.
- Care plan after the fix$99 a month
Updates on staging, daily backups, monitoring, and a real engineer on call so this never repeats.
Clean or your money back. Written.
Want to try it yourself first?
If you want to try first, these three steps are safe and genuinely useful. They also make the job faster if you end up calling us.
- 1Change your hosting password and your email password from a different device, and turn on two step login where it is offered.
- 2Look at the list of users inside your website and write down any name you do not recognise. Do not delete them yet, because that tells the attacker you noticed.
- 3Ask your host for their latest malware scan and save the email. It is free and it is the single most useful document for whoever does the cleanup.
Stop and call us if: you are about to delete files, edit code, or restore an old backup over the live site. Restoring a backup usually puts the same hole straight back and loses the orders taken since.
Questions people ask us at this exact moment
How do I know for certain my website is hacked?+
Open your own website on your phone, in a private window, by clicking a Google result rather than typing the address. Then search Google for your domain name with the word site in front of it and look for pages you never wrote. Those two checks catch most infections, because a lot of attacks deliberately hide from the owner and only show themselves to visitors arriving from search.
How much does it cost to fix a hacked website?+
A flat $249 for a standard single website, including the report, the Google review request and 30 days of watching. Online shops with stolen card details and multi site setups are quoted after a free look, and you always get the number before work starts.
Can I just restore a backup?+
Sometimes, but it is a trap more often than not. The hole that let them in was almost certainly in the backup too, so the site gets reinfected within days, and you lose every order, enquiry and post since the backup date. We use backups as evidence, not as the fix.
Will my rankings recover after the cleanup?+
Usually yes, and fairly quickly if the fake pages are removed and returned properly rather than just deleted. Damage becomes long term when spam pages sit indexed for weeks or when a Google warning stays live. Speed is the whole game here.
Who is responsible, me or my host?+
Legally and practically, you are. Your host rents you the space and protects the server, not the software you run on it. That surprises most owners, and it is why we wrote a separate page explaining exactly what your host, your developer and your plugin each do.
How did they get in?+
In our own fleet work the same three causes come up again and again: an out of date plugin with a public hole, a password reused from somewhere that leaked, and an old admin account belonging to someone who left years ago. We tell you which one it was in the report.
Do you clean websites that are not WordPress?+
Yes. Most of what we see is WordPress and WooCommerce because most of the web is, but the work is the same on other systems. On hosted platforms such as Shopify, Wix or Squarespace the problem is usually a stolen login or a bad app rather than infected files, and we will tell you honestly if that is what you have.
What if it comes back?+
For 30 days after the cleanup it is our problem and we fix it at no cost. After that, the honest answer is that a website nobody updates will eventually be hacked again, which is what the $99 a month care plan exists to prevent.
Related pages
- Google is showing a warning to my visitors
Deceptive site ahead and this site may be hacked, explained and appealed.
- My host suspended my account
What the host actually needs before they will switch you back on.
- WordPress malware removal service
The engineer level version, with named malware types and process.
- Hacked URL cleanup checklist
What to do with the spam pages Google already indexed.